---
title: "Anthropic: AI Model Independently Develops Five Exploits Against Chrome, Safari, Android, Windows, and Linux"
description: "Anthropic's AI model, during closed Frontier Red Team trials, independently developed five exploits against Chrome, Safari, Android, Windows, and Linux, including passwordless root server access. All vulnerabilities have already been patched."
date: 2026-10-29T10:18:02.225Z
lang: en
url: https://xab.info/en/posts/anthropic-ai-model-independently-develops-exploits-browsers-os
tags: [anthropic, ai-security, cybersecurity, exploit, chrome, linux, android, windows, safari, red-team]
author: "Alexander Buran, Roman V."
publisher: "XAB.info"
---

# Anthropic: AI Model Independently Develops Five Exploits Against Chrome, Safari, Android, Windows, and Linux

![Anthropic office interior with a wall display showing an AI neural model, browsers, and OS logos](https://xab.info/media/2026/10/29/anthropic-ii-samostoyatelno-razrabotala-eksploity-protiv-brauzerov-i-os/anthropic-ii-samostoyatelno-razrabotala-eksploity-protiv-brauzerov-i-os-1.webp)

## Key Points

- Anthropic's AI model independently developed five multi-stage exploits against browsers and OSes without external intervention
- In Chrome, the model chained 4 vulnerabilities and broke out of the security sandbox; in Linux, it gained root access over the network
- All discovered vulnerabilities were handed over to developers and fixed with patches
- There is no evidence of exploits being used outside Anthropic's lab; the model's name is not disclosed

Anthropic, one of the leading developers of large language models, has published the results of closed trials in which its AI model independently developed five complex cyberattack scenarios capable of bypassing the security mechanisms of the most common browsers and operating systems. The tests were conducted by a specialized Frontier Red Team in isolated laboratory conditions. According to the company, the model did not merely find isolated vulnerabilities, but independently worked out their combinations and integrated them into working exploits, demonstrating a level of autonomy that, according to experts, has not previously been recorded in similar tests.

### Browser Attacks: From Sandbox to Confidential Data

In testing Google Chrome, the model chained four separate vulnerabilities together, broke out of the security sandbox, and opened a third-party application on the device a few seconds after loading a malicious page. In the case of Safari, the AI bypassed the security mechanism that prevents websites from accessing data from other resources (Same-Origin Policy). According to specialists, such a breach potentially opens access to confidential information of authenticated users, including sessions and personal data.

### Operating Systems: From File Extraction to Root Access

On the Android platform, the exploit developed by the model allowed photos and other files to be extracted from a locked smartphone. However, implementing the attack required physical access to the device via a USB cable, which significantly narrows the application scenarios. The attack on Windows took a different form: the AI ensured the continuous triggering of a server accepting HTTP/3 requests, which caused the system to crash, though it did not grant access to stored user data. The most serious outcome was obtaining full administrator privileges (root access) on a Linux-managed server over the network without entering a login or password. At the same time, as Anthropic clarifies, successfully executing this attack required a specific network configuration, so the exploit would not work on every system running this operating system.

### Developer Reaction and Vulnerability Status

Anthropic representatives confirmed that all vulnerabilities discovered during the trials were forwarded to the respective developers—Google, Apple, Microsoft, and the Linux distribution community—and completely patched. The company emphasized that at the time of publishing the results, there is no evidence of the AI-developed exploits being used in real-world hacking attacks outside the Anthropic laboratory. Meanwhile, the company does not disclose the name of the specific model tested, nor the timeline for its potential public release.

### The Dual Nature of Autonomous AI: Protection and Threat

Cybersecurity experts, commenting on the publication, emphasize the dual nature of such developments. On the one hand, the ability of AI to independently find and combine vulnerabilities before malicious actors can exploit them represents a powerful tool for proactive infrastructure defense. On the other hand, demonstrating a fully autonomous 'digital hacker' capable of orchestrating a multi-stage attack on critical systems without human step-by-step instructions significantly increases risks. According to analysts, such tests set a new standard for evaluating AI model maturity and will likely become the norm for all major developers in the coming months.

## Fact-Check & Sources

- [Сломал Chrome, Windows и Android за секунды: Anthropic испытала цифрового хакера](https://www.rbc.ua/ukr/news/zlamav-chrome-windows-i-android-sekundi-anthropic-1793263935.html) - The primary source contains all key facts: five attack scenarios, Frontier Red Team work, details for each browser/OS, vulnerability handoff to developers, and lack of real-world usage evidence. The information aligns with the visual context (image of Anthropic's office).

## FAQ

### Which specific systems were targeted by Anthropic's AI model?

The model developed exploits for five platforms: Chrome and Safari browsers, as well as Android, Windows, and Linux operating systems. In each case, the attack scenario was multi-stage and involved a combination of multiple vulnerabilities.

### Were these exploits used in real-world cyberattacks?

No. According to Anthropic's statement, at the time of publication, there is no evidence of the AI-developed exploits being used in real-world attacks outside the company's laboratory.

### Have the discovered vulnerabilities been fixed?

Yes. All discovered vulnerabilities were forwarded to the respective developers and completely closed with released patches.

### Which AI model underwent the testing?

Anthropic does not disclose the name of the specific model that passed the tests, nor the timeline for its potential public release.

### How dangerous is the Linux attack described in the report?

The attack allowed root access to the server over the network without a login or password, but required a specific network configuration, so it would not work on every Linux system.